CVE-2017-11463: Ivanti Endpoint Manager

High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days.

In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in an HTTP payload in order to retrieve a key/token and use it to access/update objects belonging to other users. Such objects could be user profiles, tickets, incidents, etc.

Affected products

• Ivanti Endpoint Manager: version 2016.4 only; version 2017.1 only; version 2017.3 only

Published 2017-12-11. Last modified 2026-06-17.